{
  "family": "ursnifdropper",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nUrsnifDropper is a specialized, first-stage Trojan designed explicitly to facilitate the delivery and execution of the notorious Ursnif (also known as Gozi) banking trojan. This dropper acts as the initial beachhead in an attack chain, typically evading initial detection mechanisms before pulling down the more destructive secondary payload.\n\n<h3>Infection Vector and Execution Chain</h3>\nUrsnifDropper is predominantly distributed via highly coordinated malspam campaigns. These campaigns utilize socially engineered lures—often disguised as invoices, shipping documents, or legal notices—containing malicious macros within Microsoft Office documents (Word or Excel).\n\nUpon a user inadvertently enabling macros, the embedded VBA code executes, initiating the dropper's payload. UrsnifDropper immediately employs defense evasion techniques, such as API hashing and checking for virtualized environments (sandbox evasion), to ensure it is running on a genuine victim machine. Once validated, it reaches out to hardcoded, often compromised, command-and-control (C2) servers via HTTP/HTTPS to download the main Ursnif binary. The downloaded payload is then injected directly into the memory of legitimate Windows processes (like `explorer.exe` or `svchost.exe`) via process hollowing or DLL injection, effectively bypassing traditional file-based antivirus scanning.\n\n<h3>Threat Impact</h3>\nThe successful execution of UrsnifDropper almost invariably leads to a full-blown Ursnif infection. Ursnif is a sophisticated banking trojan capable of web injection, keylogging, and extensive credential theft, leading to severe financial fraud and network compromise.\n\n<h3>Mitigation Strategies</h3>\n<ul>\n<li><strong>Macro Disablement:</strong> Enforce strict Group Policy Objects (GPOs) to disable macros downloaded from the internet (Mark of the Web) across all Microsoft Office applications.</li>\n<li><strong>Email Security:</strong> Deploy advanced email filtering and sandboxing solutions to detonate and analyze attachments prior to delivery to the end-user inbox.</li>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Utilize EDR tools configured to alert on anomalous process injection (e.g., Office applications spawning `powershell.exe` or `cmd.exe`).</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "TrojanDropper.Ursnif",
    "Downloader.Ursnif",
    "Win32/UrsnifDropper"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1105",
    "T1055.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:03:45Z",
  "type": "Dropper",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}